As a Security Engineer, I want to see all misconfigured cloud resources across my AWS and GCP accounts in a single dashboard, so I can prioritize remediation without switching between consoles.
A structured PRD for a cloud security product — covering problem space, personas, functional requirements, success metrics, and release milestones.
A cloud security product had no structured requirements process. Engineering was building from verbal briefs, resulting in scope creep and missed compliance requirements. I was brought in to define the product requirements from scratch.
Ran discovery sessions with 4 enterprise buyer personas — CISOs, DevOps leads, compliance officers, and security analysts. Each had conflicting priorities. The insight: compliance teams needed auditability above all else; DevOps needed friction removal.
Chose compliance-first phasing over feature parity with competitors. Controversial with sales, but the right call — enterprise buyers in regulated sectors won't pilot tools that can't prove audit trails from day one.
PRD adopted by engineering with no major revision cycles — a first for the team. Learning: writing for the reader, not the writer, is the hardest PM skill. Every requirement needs to answer "what would a sceptical engineer ask next?"
Organizations migrating to multi-cloud environments face an exponentially growing attack surface. Security teams lack real-time visibility into misconfigurations across AWS, GCP, and Azure — leading to compliance violations, data breaches, and costly incident response.
Current state: Security reviews are manual, periodic (quarterly audits), and generate reports that are outdated by the time they're actioned. There is no continuous monitoring or automated remediation path.
Target outcome: A CSPM platform that provides continuous, automated cloud security posture monitoring — surfacing misconfigurations, policy violations, and compliance gaps in real-time with actionable remediation guidance.
Manages cloud security posture across 100s of accounts. Needs: real-time misconfiguration alerts, automated remediation, and compliance dashboards. Pain: alert fatigue from generic scanners that don't prioritize by risk.
Needs executive-level visibility into compliance posture (SOC2, ISO27001, PCI-DSS). Pain: monthly manual reporting takes 2–3 days and is error-prone. Needs: automated compliance reports on-demand.
Deploys infrastructure via CI/CD pipelines. Needs: shift-left security checks that catch misconfigurations before deployment. Pain: security feedback loop is slow — issues found weeks after deployment.
Individual developers (covered by SAST/DAST tools). Network security teams (covered by SIEM/SOAR). Small companies (<50 cloud resources) — complexity doesn't justify CSPM tooling.
As a Security Engineer, I want to see all misconfigured cloud resources across my AWS and GCP accounts in a single dashboard, so I can prioritize remediation without switching between consoles.
As a CISO, I want to generate a SOC2 compliance report with a single click, so I can share accurate posture data with auditors without manual data gathering.
As a DevOps Engineer, I want CSPM checks integrated into my Terraform CI/CD pipeline, so misconfigurations are caught before infrastructure is deployed to production.
As a Security Engineer, I want misconfiguration alerts ranked by business impact and exploitability, so I can focus on critical issues instead of drowning in low-severity noise.
Acceptance Criteria Sample (Story 1 — Unified Dashboard):
Full cloud scan completes in <15 min for up to 10,000 resources. Dashboard P95 load time <3s. API response <500ms at 95th percentile.
99.9% uptime SLA. Scheduled scans must not be affected by UI downtime. Data retention: 12 months of finding history.
Read-only cloud permissions only (no write access). All data encrypted at rest (AES-256) and in transit (TLS 1.3). SOC2 Type II compliant.
Must support customers with up to 50 cloud accounts and 100,000 resources. Multi-tenant architecture with strict data isolation.
Secondary metrics: Compliance report generation time (target: <2 min vs. current 2–3 days), number of accounts connected per customer, and net promoter score from security engineering persona.
AWS integration only. Unified misconfiguration dashboard. Severity-ranked alerts. Basic remediation guidance. Manual report export.
GCP + Azure integration. Automated compliance reports (SOC2, CIS benchmarks). API for SIEM integration. Custom policy builder.
CI/CD pipeline integration (GitHub Actions, Terraform Cloud). IaC scanning. PR-level security checks. Developer-facing remediation suggestions.
ML-based risk scoring. Attack path visualization. Auto-remediation for low-risk findings. Executive risk dashboard.